Critical · 9.8 CVE-2026-22417 EUVD-2026-9546GHSA-vff3-f8rm-pq96

WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

Published Mar 5, 2026 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: ThemeGoods Product: Grand Wedding

Description

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

Affected products

Vendor	Product	Affected	Fixed
ThemeGoods	Grand Wedding	≤ 3.1.11	—

References

https://patchstack.com/database/Wordpress/Theme/grandwedding/vulnerability/wordpress-grand-wedding-theme-3-1-0-php-object-injection-vulnerability?_s_id=cve vdb-entry